RE: business associate - yes or no?
Wendy, What is the dilemma? From your description (below) it sounds as though the "contractor" is providing diagnostic screenings and tests akin to those provided by a laboratory or other indirect treatment provider. Though the "contractor's" treatment services are paid-for by the CE does not change the (apparent) fact that PHI is being shared with the "contractor" as part of the patient's treatment process. Are there other factors here that are as yet unstated? I hope that this helps. Your questions are always welcome. Matt Matthew Rosenblum Chief Operations Officer Privacy, Quality Management & Regulatory Affairs http://www.CPIdirections.com CPI Directions, Inc. 10 West 15th Street, Suite 1922 New York, NY 10011 (212) 675-6367 [EMAIL PROTECTED] CONFIDENTIALITY NOTICE: This E-Mail is intended only for the use of the individual or entity to which it is addressed and may contain information that is privileged, confidential and exempt from disclosure under applicable law. If you have received this communication in error, please do not distribute it. Please notify the sender by E-Mail at the address shown and delete the original message. Thank you. AVISO DEL CONFIDENCIALIDAD: Este email es solamente para el uso del individuo o la entidad a la cual se dirige y puede contener información privilegiada, confidencial y exenta de acceso bajo la ley aplicable. Si usted ha recibido esta comunicación por error, por favor no lo distribuya. Favor notificar al remitente del E-Mail a la dirección mostrada y elimine el mensaje original. Gracias. -Original Message- From: Reynolds, Wendy J [mailto:[EMAIL PROTECTED] Sent: Monday, November 10, 2003 1:06 PM To: WEDI SNIP Privacy Workgroup List Subject: business associate - yes or no? I am in the process of reviewing a contact which will entail an agreement between us (a covered entity) and the contractor (another covered entity) in which the contractor will provide cancer screening/diagnostic tests to a specific category of women (income guidelines, age, etc.) per grant parameters. I am having trouble with this one, because usually "treatment" reasons do not necessitate a business associate agreement between two covered entities. However, we are paying the contractor a per capita rate to provide the services (diagnostic tests) to these patients. If patients need further treatment, they are referred back to us to take care of. In this situation, I am not sure the contractor is really providing "treatment" to the patients. Furthermore, in this situation, the contractor is providing this service on our behalf, for us, and are receiving money from us to provide these services. This arrangement does not fit the business associate exceptions or examples as listed on the OCR website. I have read the definition of treatment in the regs, but really think this arrangement should have a BAA. But of course the contractor disagrees. Am I being too picky? Any opinions out there? Wendy J. Reynolds, MPA, CHP EVMS Director of Privacy Program EVMS HS Clinical Auditor Eastern Virginia Medical School Fairfax Hall, 1st floor 721 Fairfax Avenue Norfolk, VA 23507 (757) 446-0337 [EMAIL PROTECTED] --- Outgoing mail is certified Virus Free. Checked by AVG anti-virus system (http://www.grisoft.com). Version: 6.0.537 / Virus Database: 332 - Release Date: 11/6/2003 --- The WEDI SNIP listserv to which you are subscribed is not moderated. The discussions on this listserv therefore represent the views of the individual participants, and do not necessarily represent the views of the WEDI Board of Directors nor WEDI SNIP. If you wish to receive an official opinion, post your question to the WEDI SNIP Issues Database at http://snip.wedi.org/tracking/. These listservs should not be used for commercial marketing purposes or discussion of specific vendor products and services. They also are not intended to be used as a forum for personal disagreements or unprofessional communication at any time. You are currently subscribed to wedi-privacy as: [EMAIL PROTECTED] To unsubscribe from this list, go to the Subscribe/Unsubscribe form at http://subscribe.wedi.org or send a blank email to [EMAIL PROTECTED] If you need to unsubscribe but your current email address is not the same as the address subscribed to the list, please use the Subscribe/Unsubscribe form at http://subscribe.wedi.org --- The WEDI SNIP listserv to which you are subscribed is not moderated. The discussions on this listserv therefore represent the views of the individual participants, and do not necessarily represent the views of the WEDI Board of Directors nor WEDI SNIP. If you wish to receive an official opinion, post your question to the WEDI SNIP Issues Database at http://snip.wedi.org/tracking/. These listservs should not be used for commercial marketing purposes or discussion of specific vendor products and services. They also are not intended to be used as a forum for personal
RE: business associate - yes or no?
Wendy, Just to add my own humble opinion I think that Errick has a good point - one worth emphasizing. Don't let the flow of money confuse the issue. The definition of business associate does not mention who is paying who; just what is done, and for whom. I think what you have to look at (as you indicate below) is what services are being provided, are they done on your behalf, and do some of these services go beyond the realm of treatment. We (as a nursing facility) have contracts with several providers to define the services provided to residents of the facility, but these contracts address treatment and do not necessarily bring us into the realm of a business associate relationship. Some of the providers provide services that go beyond treatment, and are for our benefit; in those cases, we sign a BAA. Some of the providers simply provide treatment, and the contracts are required for other reasons, but pretty much just say they are there for treatment of residents; we do not sign BAA with them. Just my own thoughts. I think sometimes we let other details confuse us (kinda like the math word problems when we were kids, and we had to identify which information given to us was necessary to solve the problem). I do remember OCR stating that just because a provider has a contract with someone does not mean that they are a business associate. Rather, the nature of the relationship has to be examined to determine if they are a BA. Rachel -Original Message- From: Reynolds, Wendy J [mailto:[EMAIL PROTECTED] Sent: Monday, November 10, 2003 1:28 PM To: WEDI SNIP Privacy Workgroup List Subject: RE: business associate - yes or no? I guess my heartburn with this one is that this is the not the "normal indirect treatment relationship" which we'd normally have with another covered entity. This is for contracted services. We receive grant money, and in turn we contract with a hospital to provide breast and cervical cancer screenings and follow up diagnostic services. This contract is for the contractor to follow our criteria for patient eligibility, we tell the contractor what types of services to provide and how often, we also tell the contractor how to report the findings. Furthermore, the contractor must perform case management, surveillance, transportation as per the agreement signed by us. The contractor also has to provide a percentage of matching funds which may include a differential between any usual fees charged and the reimbursable capita rate. I can understand that diagnostic services are "indirect treatment", but these services are not the same as a doctor referring patients to an independent diagnostic facility. There are other operational type things going on beside treatment. If I cannot talk the contractor into signing a mutually acceptable BAA, I will probably let them execute without it and pose the question to OCR (and wait 6 months for an answer...) Thank you everyone who replied. I appreciate the sounding board. Wendy J. Reynolds, MPA, CHP EVMS Director of Privacy Program EVMS HS Clinical Auditor Eastern Virginia Medical School Fairfax Hall, 1st floor 721 Fairfax Avenue Norfolk, VA 23507 (757) 446-0337 [EMAIL PROTECTED] -Original Message- From: taway3 [mailto:[EMAIL PROTECTED] Sent: Monday, November 10, 2003 2:18 PM To: WEDI SNIP Privacy Workgroup List Subject: RE: business associate - yes or no? Rachel and Wendy, I'm going to respectfully disagree. If my physician sends me to an imaging facility for x-ray, would that not be a treatment relationship? My understanding is that two CE's collaborating on treatment do not require a BAA. What is different here? Regards, Roger Wernow RMW Associates (A Consulting Company) 321-956-0485 -Original Message- From: Rachel Foerster [mailto:[EMAIL PROTECTED] Sent: Monday, November 10, 2003 1:38 PM To: WEDI SNIP Privacy Workgroup List Subject: RE: business associate - yes or no? Wendy, based on your description of this activity I would conclude that your contractor is indeed your business associate. You have engaged this contractor to perform a function on your behalf using PHI. Rachel Foerster Rachel Foerster & Associates, Ltd. Voice: 847-872-8070 email: [EMAIL PROTECTED] -Original Message- From: Reynolds, Wendy J [mailto:[EMAIL PROTECTED] Sent: Monday, November 10, 2003 12:06 PM To: WEDI SNIP Privacy Workgroup List Subject: business associate - yes or no? I am in the process of reviewing a contact which will entail an agreement between us (a covered entity) and the contractor (another covered entity) in which the contractor will provide cancer screening/diagnostic tests to a specific category of women (income guidelines, age, etc.) per grant parameters. I am having trouble with this one, because usually "treatment" reasons do not necessitate a business associate agreement between two covered entities. However, we are paying th
RE: business associate - yes or no?
Wendy: I can see why you are concerned. DHHS has not addressed this question directly. But the text of the Privacy Rule, and DHHS statements suggest that this relationship is not one that requires a BA agreement. Here is the logic: 1. (a) A business associate agreement is not required for "disclosures by a covered entity to a health care provider concerning the treatment of the individual.." (45 CFR 164.502(e)(1)(ii)(A)); (b) "Treatment" is defined to mean: "the provision, coordination, or management of health care and related services by one or more health care providers, including the coordination or management of health care by a health care provider with a third party; consultation between health care providers relating to a patient; or the referral of a patient for health care from one health care provider to another". (45 CFR 160.103) (c) "Health care" includes, but is not be limited to, preventive, diagnostic, therapeutic, rehabilitative, maintenance and palliative care, and counseling, service, assessment, or procedure with respect to the physical or mental condition, or functional status, or an individual or that affects the structure or function of the body; and the ...sale or dispensing of a drug, device, equipment, or other item in accordance with a prescription". (45 CFR 160.103) Based on (a), (b), and (c), I have no doubt that EVMS disclosure of PHI to the diagnostic center is a disclosure "by a covered entity health care provider concerning treatment", and permitted by the Privacy Rule w/o consent or authorization. The only question is whether the diagnostic center is somehow acting as a business associate. 2. The definition of "business associate" points towards provision of services other than treatment services. It is: (i) a person or organization that, on behalf of a covered entity or an organized health care arrangement, performs functions involving the use or disclosure of individually identifiable health information, including claims processing, data analysis, data processing or administration, utilization review, quality assurance, billing, benefit management, re-pricing, or other functions regulated by [the HIPAA rules], or (ii) a person or organization (other than a member of the workforce) that provides legal, actuarial, accounting, consulting, data aggregation, management, administrative, accreditation, or financial services to a covered entity or organized health care arrangement, and receives protected health information in the course of performance of those services. (45 CFR 160.103) 3. DHHS has made it clear that business associate agreements are not required between health care providers, between hospitals and members of the medical staff, between clinical providers and clinical laboratories, or between health plans and health care providers. (The fact that the health plan pays a provider that delivers treatment doesn't make the provider a business associate.) (See the 3/27/02 NPRM at 67 Federal Register 14787 and the 12/02 guidance from the DHHS Office of Civil Rights.) 4. Your financial relationship with the diagnostic center is similar to that of a health plan and a network provider. That fact that you pay them on a capitated basis doesn't make the diagnostic center your agent, or mean that they are "acting on your behalf". 5. Overall, your relationship is more like that between covered entities interested in arranging "treatment" services to a group of individuals, and less like one in which the diagnostic center is acting on your behalf with regard to a function other than direct treatment. That's my two cents. I suggest that you present the question to EVMS' attorneys. Please don't rely on my opinion (or that of anyone else other than your legal counsel). Paul NOTICE: This message and its attachments are confidential and may be protected by the attorney/client privilege. If you have received it in error, please notify the sender immediately by e-mail and delete and destroy this message and its attachments. Paul Litwak Attorney & Counselor at Law 2832 S. Lynnhaven Rd., Suite 202 Virginia Beach, VA 23452 Ph: 757-431-2020 Fax: 757-431-3688 EMail: [EMAIL PROTECTED] Web: www.paul-litwak.com Web: www.hipaacomplianceguide.com -Original Message- From: Reynolds, Wendy J [mailto:[EMAIL PROTECTED] Sent: Monday, November 10, 2003 1:06 PM To: WEDI SNIP Privacy Workgroup List Subject: business associate - yes or no? I am in the process of reviewing a contact which will entail an agreement between us (a covered entity) and the contractor (another covered entity) in which the contractor will provide cancer screening/diagnostic tests to a specific category of women (income guidelines, age, etc.) per grant parameters. I am having trouble with this one, because usually "treatment" reasons do not necessitate a business associate agreement between two covered entities. However, we are paying the contractor a per
RE: business associate - yes or no?
Health care providers often send out patients or specimens for tests. They also often bill the patients for those services and then pay the entity performing the tests. As a patient, I like this as I get a consolidated bill. The example below is exactly this relationship. If this relationship requires a BAA, then, among others, so does every relationship between a health care provider and a clinical laboratory or test provider -- for a mammography, MRI, x-ray, etc. It is clear that laboratories and others who do testing are health care providers. It also is clear that BAAs are not needed between health care providers when they are providing treatment. === The opinions expressed in this message are mine only, and do not reflect the opinion or position of my employer. - Andrew H. Melczer, Ph.D. Vice President, Health Policy Research Illinois State Medical Society 20 N. Michigan, Suite 700 Chicago, IL 60602 312-580-2468 FAX: 312-782-1654 E-mail: mailto:[EMAIL PROTECTED] -Original Message- From: Huber, Cheri [mailto:[EMAIL PROTECTED] Sent: Monday, November 10, 2003 1:46 PM To: WEDI SNIP Privacy Workgroup List Subject: RE: business associate - yes or no? I tend to agree, Rachel, that on its face the relationship described by Wendy meets the definition of a BA relationship. However, I must point out that (my recollection of) the Rule as well as language from both the Preamble and subsequent guidances refer to business associate activities as being 'business-type services' and I can't recall any reference to treatment in any of the examples of such a service. Because the sort of situation described by Wendy is not unusual, and because reasonable minds obviously disagree, it would be helpful to have the OCR's "official" opinion on this issue. I will submit the question to the OCR unless someone chimes in to this exchange to advise that this has already been formally addressed. Thank you. Cheri Huber Napa County Privacy Officer 1195 Third Street, Suite 301 Napa, CA 94559 707-253-4523 [EMAIL PROTECTED] -Original Message- From: Rachel Foerster [mailto:[EMAIL PROTECTED] Sent: Monday, November 10, 2003 11:27 AM To: WEDI SNIP Privacy Workgroup List Subject: RE: business associate - yes or no? Roger, the key difference in this scenario and which brought me to my conclusions is this statement by Wendy: " . . . the contractor is providing this service on our behalf, for us, and are receiving money from us to provide these services. " Therefore, the contractor is providing treatment services on behalf of Wendy's company and Wendy's company is paying the contractor for those services performed, not the patient. Neither is the contractor submitting a claim to a payer for reimbursement. While it's not totally clear, it does appear that Wendy's company is a healthcare provider and is contracting with another healthcare provider to perform treatment services to its patients on its behalf. Rachel Rachel Foerster Rachel Foerster & Associates, Ltd. Voice: 847-872-8070 email: [EMAIL PROTECTED] -Original Message- From: taway3 [mailto:[EMAIL PROTECTED] Sent: Monday, November 10, 2003 1:18 PM To: Rachel Foerster; WEDI SNIP Privacy Workgroup List Subject: RE: business associate - yes or no? Rachel and Wendy, I'm going to respectfully disagree. If my physician sends me to an imaging facility for x-ray, would that not be a treatment relationship? My understanding is that two CE's collaborating on treatment do not require a BAA. What is different here? Regards, Roger Wernow RMW Associates (A Consulting Company) 321-956-0485 -Original Message- From: Rachel Foerster [mailto:[EMAIL PROTECTED] Sent: Monday, November 10, 2003 1:38 PM To: WEDI SNIP Privacy Workgroup List Subject: RE: business associate - yes or no? Wendy, based on your description of this activity I would conclude that your contractor is indeed your business associate. You have engaged this contractor to perform a function on your behalf using PHI. Rachel Foerster Rachel Foerster & Associates, Ltd. Voice: 847-872-8070 email: [EMAIL PROTECTED] -Original Message- From: Reynolds, Wendy J [mailto:[EMAIL PROTECTED] Sent: Monday, November 10, 2003 12:06 PM To: WEDI SNIP Privacy Workgroup List Subject: business associate - yes or no? I am in the process of reviewing a contact which will entail an agreement between us (a covered entity) and the contractor (another covered entity) in which the contractor will provide cancer screening/diagnostic tests to a specific category of women (income guidelines, age, etc.) per grant parameters. I am having trouble with this one, because usually "treatment" reasons do not necessitate a business associate agreement between two c
RE: business associate - yes or no?
Who is receiving payment from whom is not always the deciding factor. At my organization, we contract for Medical Directors, they are doing that on our behalf, and they are being paid... but in their role of providing treatment to our residents, they are NOT BAs. In our situation, they are considered part of an OHCA. (BTW, when these same Medical Directors participate in our QA efforts, *then* they are doing something for us as a facility, vs. for our residents, and they are BAs.) Typically, if the relationship is solely for the purposes of treatment or solely for the purposes of payment, a BA relationship does not exist. It's when you get into HCO that there is more likely to be a BA relationship. In the given situation, it seems that there are cross-referrals going on (your CE to the diagnostic CE; and they back to you if necessary) - but referrals qualify as treatment, so no BA. It also seems that when they provide the treatment, they are 1) providing treatment, and 2) doing so on their own behalf (regardless of whom is paying them to do so). It also seems that when you are paying them, you are acting on your own behalf, just as any payor is acting on its own behalf when it pays. Just my 2c. Sherriann Hamilton, Privacy Officer/Training Director The Christian Church Homes of KY 12700 Shelbyville Road, Ste. 1000 Louisville, KY 40243 (502) 254-4254 - phone (502) 396-4217 - cell (502) 254-5117 - fax Please check out our web site at www.cchk.org -Original Message- From: Rachel Foerster [mailto:[EMAIL PROTECTED] Sent: Monday, November 10, 2003 2:27 PM To: WEDI SNIP Privacy Workgroup List Subject: RE: business associate - yes or no? Roger, the key difference in this scenario and which brought me to my conclusions is this statement by Wendy: " . . . the contractor is providing this service on our behalf, for us, and are receiving money from us to provide these services. " Therefore, the contractor is providing treatment services on behalf of Wendy's company and Wendy's company is paying the contractor for those services performed, not the patient. Neither is the contractor submitting a claim to a payer for reimbursement. While it's not totally clear, it does appear that Wendy's company is a healthcare provider and is contracting with another healthcare provider to perform treatment services to its patients on its behalf. Rachel Rachel Foerster Rachel Foerster & Associates, Ltd. Voice: 847-872-8070 email: [EMAIL PROTECTED] -Original Message- From: taway3 [mailto:[EMAIL PROTECTED] Sent: Monday, November 10, 2003 1:18 PM To: Rachel Foerster; WEDI SNIP Privacy Workgroup List Subject: RE: business associate - yes or no? Rachel and Wendy, I'm going to respectfully disagree. If my physician sends me to an imaging facility for x-ray, would that not be a treatment relationship? My understanding is that two CE's collaborating on treatment do not require a BAA. What is different here? Regards, Roger Wernow RMW Associates (A Consulting Company) 321-956-0485 -Original Message- From: Rachel Foerster [mailto:[EMAIL PROTECTED] Sent: Monday, November 10, 2003 1:38 PM To: WEDI SNIP Privacy Workgroup List Subject: RE: business associate - yes or no? Wendy, based on your description of this activity I would conclude that your contractor is indeed your business associate. You have engaged this contractor to perform a function on your behalf using PHI. Rachel Foerster Rachel Foerster & Associates, Ltd. Voice: 847-872-8070 email: [EMAIL PROTECTED] -Original Message- From: Reynolds, Wendy J [mailto:[EMAIL PROTECTED] Sent: Monday, November 10, 2003 12:06 PM To: WEDI SNIP Privacy Workgroup List Subject: business associate - yes or no? I am in the process of reviewing a contact which will entail an agreement between us (a covered entity) and the contractor (another covered entity) in which the contractor will provide cancer screening/diagnostic tests to a specific category of women (income guidelines, age, etc.) per grant parameters. I am having trouble with this one, because usually "treatment" reasons do not necessitate a business associate agreement between two covered entities. However, we are paying the contractor a per capita rate to provide the services (diagnostic tests) to these patients. If patients need further treatment, they are referred back to us to take care of. In this situation, I am not sure the contractor is really providing "treatment" to the patients. Furthermore, in this situation, the contractor is providing this service on our behalf, for us, and are receiving money from us to provide these services. This arrangement does not fit the business associate exceptions or examples as listed on the OCR website. I have read the definition of treatment in the regs, but really think this arrangement should have a BAA. But of course the contractor disagrees. Am I bei
RE: business associate - yes or no?
I guess my heartburn with this one is that this is the not the "normal indirect treatment relationship" which we'd normally have with another covered entity. This is for contracted services. We receive grant money, and in turn we contract with a hospital to provide breast and cervical cancer screenings and follow up diagnostic services. This contract is for the contractor to follow our criteria for patient eligibility, we tell the contractor what types of services to provide and how often, we also tell the contractor how to report the findings. Furthermore, the contractor must perform case management, surveillance, transportation as per the agreement signed by us. The contractor also has to provide a percentage of matching funds which may include a differential between any usual fees charged and the reimbursable capita rate. I can understand that diagnostic services are "indirect treatment", but these services are not the same as a doctor referring patients to an independent diagnostic facility. There are other operational type things going on beside treatment. If I cannot talk the contractor into signing a mutually acceptable BAA, I will probably let them execute without it and pose the question to OCR (and wait 6 months for an answer...) Thank you everyone who replied. I appreciate the sounding board. Wendy J. Reynolds, MPA, CHP EVMS Director of Privacy Program EVMS HS Clinical Auditor Eastern Virginia Medical School Fairfax Hall, 1st floor 721 Fairfax Avenue Norfolk, VA 23507 (757) 446-0337 [EMAIL PROTECTED] -Original Message- From: taway3 [mailto:[EMAIL PROTECTED] Sent: Monday, November 10, 2003 2:18 PM To: WEDI SNIP Privacy Workgroup List Subject: RE: business associate - yes or no? Rachel and Wendy, I'm going to respectfully disagree. If my physician sends me to an imaging facility for x-ray, would that not be a treatment relationship? My understanding is that two CE's collaborating on treatment do not require a BAA. What is different here? Regards, Roger Wernow RMW Associates (A Consulting Company) 321-956-0485 -Original Message- From: Rachel Foerster [mailto:[EMAIL PROTECTED] Sent: Monday, November 10, 2003 1:38 PM To: WEDI SNIP Privacy Workgroup List Subject: RE: business associate - yes or no? Wendy, based on your description of this activity I would conclude that your contractor is indeed your business associate. You have engaged this contractor to perform a function on your behalf using PHI. Rachel Foerster Rachel Foerster & Associates, Ltd. Voice: 847-872-8070 email: [EMAIL PROTECTED] -Original Message- From: Reynolds, Wendy J [mailto:[EMAIL PROTECTED] Sent: Monday, November 10, 2003 12:06 PM To: WEDI SNIP Privacy Workgroup List Subject: business associate - yes or no? I am in the process of reviewing a contact which will entail an agreement between us (a covered entity) and the contractor (another covered entity) in which the contractor will provide cancer screening/diagnostic tests to a specific category of women (income guidelines, age, etc.) per grant parameters. I am having trouble with this one, because usually "treatment" reasons do not necessitate a business associate agreement between two covered entities. However, we are paying the contractor a per capita rate to provide the services (diagnostic tests) to these patients. If patients need further treatment, they are referred back to us to take care of. In this situation, I am not sure the contractor is really providing "treatment" to the patients. Furthermore, in this situation, the contractor is providing this service on our behalf, for us, and are receiving money from us to provide these services. This arrangement does not fit the business associate exceptions or examples as listed on the OCR website. I have read the definition of treatment in the regs, but really think this arrangement should have a BAA. But of course the contractor disagrees. Am I being too picky? Any opinions out there? Wendy J. Reynolds, MPA, CHP EVMS Director of Privacy Program EVMS HS Clinical Auditor Eastern Virginia Medical School Fairfax Hall, 1st floor 721 Fairfax Avenue Norfolk, VA 23507 (757) 446-0337 [EMAIL PROTECTED] --- Outgoing mail is certified Virus Free. Checked by AVG anti-virus system (http://www.grisoft.com). Version: 6.0.537 / Virus Database: 332 - Release Date: 11/6/2003 --- The WEDI SNIP listserv to which you are subscribed is not moderated. The discussions on this listserv therefore represent the views of the individual participants, and do not necessarily represent the views of the WEDI Board of Directors nor WEDI SNIP. If you wish to receive an official opinion, post your question to the WEDI SNIP Issues Database at http://snip.wedi.org/tracking/. These listservs should not be used for commercial marketing purposes or discussion of specific vendor products and services. They also are not intended to be u
RE: business associate - yes or no?
I tend to agree, Rachel, that on its face the relationship described by Wendy meets the definition of a BA relationship. However, I must point out that (my recollection of) the Rule as well as language from both the Preamble and subsequent guidances refer to business associate activities as being 'business-type services' and I can't recall any reference to treatment in any of the examples of such a service. Because the sort of situation described by Wendy is not unusual, and because reasonable minds obviously disagree, it would be helpful to have the OCR's "official" opinion on this issue. I will submit the question to the OCR unless someone chimes in to this exchange to advise that this has already been formally addressed. Thank you. Cheri Huber Napa County Privacy Officer 1195 Third Street, Suite 301 Napa, CA 94559 707-253-4523 [EMAIL PROTECTED] -Original Message- From: Rachel Foerster [mailto:[EMAIL PROTECTED] Sent: Monday, November 10, 2003 11:27 AM To: WEDI SNIP Privacy Workgroup List Subject: RE: business associate - yes or no? Roger, the key difference in this scenario and which brought me to my conclusions is this statement by Wendy: " . . . the contractor is providing this service on our behalf, for us, and are receiving money from us to provide these services. " Therefore, the contractor is providing treatment services on behalf of Wendy's company and Wendy's company is paying the contractor for those services performed, not the patient. Neither is the contractor submitting a claim to a payer for reimbursement. While it's not totally clear, it does appear that Wendy's company is a healthcare provider and is contracting with another healthcare provider to perform treatment services to its patients on its behalf. Rachel Rachel Foerster Rachel Foerster & Associates, Ltd. Voice: 847-872-8070 email: [EMAIL PROTECTED] -Original Message- From: taway3 [mailto:[EMAIL PROTECTED] Sent: Monday, November 10, 2003 1:18 PM To: Rachel Foerster; WEDI SNIP Privacy Workgroup List Subject: RE: business associate - yes or no? Rachel and Wendy, I'm going to respectfully disagree. If my physician sends me to an imaging facility for x-ray, would that not be a treatment relationship? My understanding is that two CE's collaborating on treatment do not require a BAA. What is different here? Regards, Roger Wernow RMW Associates (A Consulting Company) 321-956-0485 -Original Message- From: Rachel Foerster [mailto:[EMAIL PROTECTED] Sent: Monday, November 10, 2003 1:38 PM To: WEDI SNIP Privacy Workgroup List Subject: RE: business associate - yes or no? Wendy, based on your description of this activity I would conclude that your contractor is indeed your business associate. You have engaged this contractor to perform a function on your behalf using PHI. Rachel Foerster Rachel Foerster & Associates, Ltd. Voice: 847-872-8070 email: [EMAIL PROTECTED] -Original Message- From: Reynolds, Wendy J [mailto:[EMAIL PROTECTED] Sent: Monday, November 10, 2003 12:06 PM To: WEDI SNIP Privacy Workgroup List Subject: business associate - yes or no? I am in the process of reviewing a contact which will entail an agreement between us (a covered entity) and the contractor (another covered entity) in which the contractor will provide cancer screening/diagnostic tests to a specific category of women (income guidelines, age, etc.) per grant parameters. I am having trouble with this one, because usually "treatment" reasons do not necessitate a business associate agreement between two covered entities. However, we are paying the contractor a per capita rate to provide the services (diagnostic tests) to these patients. If patients need further treatment, they are referred back to us to take care of. In this situation, I am not sure the contractor is really providing "treatment" to the patients. Furthermore, in this situation, the contractor is providing this service on our behalf, for us, and are receiving money from us to provide these services. This arrangement does not fit the business associate exceptions or examples as listed on the OCR website. I have read the definition of treatment in the regs, but really think this arrangement should have a BAA. But of course the contractor disagrees. Am I being too picky? Any opinions out there? Wendy J. Reynolds, MPA, CHP EVMS Director of Privacy Program EVMS HS Clinical Auditor Eastern Virginia Medical School Fairfax Hall, 1st floor 721 Fairfax Avenue Norfolk, VA 23507 (757) 446-0337 [EMAIL PROTECTED] --- The WEDI SNIP listserv to which you are subscribed is not moderated. The discussions on this listserv therefore represent the views of the individual participants, and do not necessarily represent the views of the WEDI Board of Directors nor WEDI SNIP. If you wish to receive an official opinion, post your ques
Re: business associate - yes or no?
Wendy, If this contractor was just running tests for you, I would say a BAA is in order. Since the contractor is a provider, is running diagnostic tests, is interpreting those tests, and sending you (the referring agent) the results and recommendations, I would say they are engaging in treatment, and no BAA is required. The fact that you pay the other provider is, I believe, just a detractor from the opinion that they are providing treatment. Whether you pass the charges on or not is incidental, in that one way or another they are built in to your margin. This sounds like a referral to another specialty service for Dx and referral back for treatment. Like that of a radiologist or pathologist with an indirect treatment relationship, and working on contract. The information above is my opinion only, and not that of my clients. It is for discussion and not meant as advice for HIPAA compliance. Errick Woosley, MPA E Woosley & Assoc (513) 218-7436 --- The WEDI SNIP listserv to which you are subscribed is not moderated. The discussions on this listserv therefore represent the views of the individual participants, and do not necessarily represent the views of the WEDI Board of Directors nor WEDI SNIP. If you wish to receive an official opinion, post your question to the WEDI SNIP Issues Database at http://snip.wedi.org/tracking/. These listservs should not be used for commercial marketing purposes or discussion of specific vendor products and services. They also are not intended to be used as a forum for personal disagreements or unprofessional communication at any time. You are currently subscribed to wedi-privacy as: [EMAIL PROTECTED] To unsubscribe from this list, go to the Subscribe/Unsubscribe form at http://subscribe.wedi.org or send a blank email to [EMAIL PROTECTED] If you need to unsubscribe but your current email address is not the same as the address subscribed to the list, please use the Subscribe/Unsubscribe form at http://subscribe.wedi.org
RE: business associate - yes or no?
Roger, the key difference in this scenario and which brought me to my conclusions is this statement by Wendy: " . . . the contractor is providing this service on our behalf, for us, and are receiving money from us to provide these services. " Therefore, the contractor is providing treatment services on behalf of Wendy's company and Wendy's company is paying the contractor for those services performed, not the patient. Neither is the contractor submitting a claim to a payer for reimbursement. While it's not totally clear, it does appear that Wendy's company is a healthcare provider and is contracting with another healthcare provider to perform treatment services to its patients on its behalf. Rachel Rachel Foerster Rachel Foerster & Associates, Ltd. Voice: 847-872-8070 email: [EMAIL PROTECTED] -Original Message- From: taway3 [mailto:[EMAIL PROTECTED] Sent: Monday, November 10, 2003 1:18 PM To: Rachel Foerster; WEDI SNIP Privacy Workgroup List Subject: RE: business associate - yes or no? Rachel and Wendy, I'm going to respectfully disagree. If my physician sends me to an imaging facility for x-ray, would that not be a treatment relationship? My understanding is that two CE's collaborating on treatment do not require a BAA. What is different here? Regards, Roger Wernow RMW Associates (A Consulting Company) 321-956-0485 -Original Message- From: Rachel Foerster [mailto:[EMAIL PROTECTED] Sent: Monday, November 10, 2003 1:38 PM To: WEDI SNIP Privacy Workgroup List Subject: RE: business associate - yes or no? Wendy, based on your description of this activity I would conclude that your contractor is indeed your business associate. You have engaged this contractor to perform a function on your behalf using PHI. Rachel Foerster Rachel Foerster & Associates, Ltd. Voice: 847-872-8070 email: [EMAIL PROTECTED] -Original Message- From: Reynolds, Wendy J [mailto:[EMAIL PROTECTED] Sent: Monday, November 10, 2003 12:06 PM To: WEDI SNIP Privacy Workgroup List Subject: business associate - yes or no? I am in the process of reviewing a contact which will entail an agreement between us (a covered entity) and the contractor (another covered entity) in which the contractor will provide cancer screening/diagnostic tests to a specific category of women (income guidelines, age, etc.) per grant parameters. I am having trouble with this one, because usually "treatment" reasons do not necessitate a business associate agreement between two covered entities. However, we are paying the contractor a per capita rate to provide the services (diagnostic tests) to these patients. If patients need further treatment, they are referred back to us to take care of. In this situation, I am not sure the contractor is really providing "treatment" to the patients. Furthermore, in this situation, the contractor is providing this service on our behalf, for us, and are receiving money from us to provide these services. This arrangement does not fit the business associate exceptions or examples as listed on the OCR website. I have read the definition of treatment in the regs, but really think this arrangement should have a BAA. But of course the contractor disagrees. Am I being too picky? Any opinions out there? Wendy J. Reynolds, MPA, CHP EVMS Director of Privacy Program EVMS HS Clinical Auditor Eastern Virginia Medical School Fairfax Hall, 1st floor 721 Fairfax Avenue Norfolk, VA 23507 (757) 446-0337 [EMAIL PROTECTED] --- Outgoing mail is certified Virus Free. Checked by AVG anti-virus system (http://www.grisoft.com). Version: 6.0.537 / Virus Database: 332 - Release Date: 11/6/2003 --- The WEDI SNIP listserv to which you are subscribed is not moderated. The discussions on this listserv therefore represent the views of the individual participants, and do not necessarily represent the views of the WEDI Board of Directors nor WEDI SNIP. If you wish to receive an official opinion, post your question to the WEDI SNIP Issues Database at http://snip.wedi.org/tracking/. These listservs should not be used for commercial marketing purposes or discussion of specific vendor products and services. They also are not intended to be used as a forum for personal disagreements or unprofessional communication at any time. You are currently subscribed to wedi-privacy as: [EMAIL PROTECTED] To unsubscribe from this list, go to the Subscribe/Unsubscribe form at http://subscribe.wedi.org or send a blank email to [EMAIL PROTECTED] If you need to unsubscribe but your current email address is not the same as the address subscribed to the list, please use the Subscribe/Unsubscribe form at http://subscribe.wedi.org --- The WEDI SNIP listserv to which you are subscribed is not moderated. The discussions on this listserv therefore represent the views of the individual participants, and do not necessarily represent the views of the WEDI Board of Direc
RE: business associate - yes or no?
Rachel and Wendy, I'm going to respectfully disagree. If my physician sends me to an imaging facility for x-ray, would that not be a treatment relationship? My understanding is that two CE's collaborating on treatment do not require a BAA. What is different here? Regards, Roger Wernow RMW Associates (A Consulting Company) 321-956-0485 -Original Message- From: Rachel Foerster [mailto:[EMAIL PROTECTED] Sent: Monday, November 10, 2003 1:38 PM To: WEDI SNIP Privacy Workgroup List Subject: RE: business associate - yes or no? Wendy, based on your description of this activity I would conclude that your contractor is indeed your business associate. You have engaged this contractor to perform a function on your behalf using PHI. Rachel Foerster Rachel Foerster & Associates, Ltd. Voice: 847-872-8070 email: [EMAIL PROTECTED] -Original Message- From: Reynolds, Wendy J [mailto:[EMAIL PROTECTED] Sent: Monday, November 10, 2003 12:06 PM To: WEDI SNIP Privacy Workgroup List Subject: business associate - yes or no? I am in the process of reviewing a contact which will entail an agreement between us (a covered entity) and the contractor (another covered entity) in which the contractor will provide cancer screening/diagnostic tests to a specific category of women (income guidelines, age, etc.) per grant parameters. I am having trouble with this one, because usually "treatment" reasons do not necessitate a business associate agreement between two covered entities. However, we are paying the contractor a per capita rate to provide the services (diagnostic tests) to these patients. If patients need further treatment, they are referred back to us to take care of. In this situation, I am not sure the contractor is really providing "treatment" to the patients. Furthermore, in this situation, the contractor is providing this service on our behalf, for us, and are receiving money from us to provide these services. This arrangement does not fit the business associate exceptions or examples as listed on the OCR website. I have read the definition of treatment in the regs, but really think this arrangement should have a BAA. But of course the contractor disagrees. Am I being too picky? Any opinions out there? Wendy J. Reynolds, MPA, CHP EVMS Director of Privacy Program EVMS HS Clinical Auditor Eastern Virginia Medical School Fairfax Hall, 1st floor 721 Fairfax Avenue Norfolk, VA 23507 (757) 446-0337 [EMAIL PROTECTED] --- Outgoing mail is certified Virus Free. Checked by AVG anti-virus system (http://www.grisoft.com). Version: 6.0.537 / Virus Database: 332 - Release Date: 11/6/2003 --- The WEDI SNIP listserv to which you are subscribed is not moderated. The discussions on this listserv therefore represent the views of the individual participants, and do not necessarily represent the views of the WEDI Board of Directors nor WEDI SNIP. If you wish to receive an official opinion, post your question to the WEDI SNIP Issues Database at http://snip.wedi.org/tracking/. These listservs should not be used for commercial marketing purposes or discussion of specific vendor products and services. They also are not intended to be used as a forum for personal disagreements or unprofessional communication at any time. You are currently subscribed to wedi-privacy as: [EMAIL PROTECTED] To unsubscribe from this list, go to the Subscribe/Unsubscribe form at http://subscribe.wedi.org or send a blank email to [EMAIL PROTECTED] If you need to unsubscribe but your current email address is not the same as the address subscribed to the list, please use the Subscribe/Unsubscribe form at http://subscribe.wedi.org --- The WEDI SNIP listserv to which you are subscribed is not moderated. The discussions on this listserv therefore represent the views of the individual participants, and do not necessarily represent the views of the WEDI Board of Directors nor WEDI SNIP. If you wish to receive an official opinion, post your question to the WEDI SNIP Issues Database at http://snip.wedi.org/tracking/. These listservs should not be used for commercial marketing purposes or discussion of specific vendor products and services. They also are not intended to be used as a forum for personal disagreements or unprofessional communication at any time. You are currently subscribed to wedi-privacy as: [EMAIL PROTECTED] To unsubscribe from this list, go to the Subscribe/Unsubscribe form at http://subscribe.wedi.org or send a blank email to [EMAIL PROTECTED] If you need to unsubscribe but your current email address is not the same as the address subscribed to the list, please use the Subscribe/Unsubscribe form at http://subscribe.wedi.org --- The WEDI SNIP listserv to which you are subscribed is not moderated. The discussions on this listserv therefore represent the views of the individual participants, and do not necessarily represent the views of the WEDI Board of Directors nor WEDI SNIP. I
RE: business associate - yes or no?
Wendy, based on your description of this activity I would conclude that your contractor is indeed your business associate. You have engaged this contractor to perform a function on your behalf using PHI. Rachel Foerster Rachel Foerster & Associates, Ltd. Voice: 847-872-8070 email: [EMAIL PROTECTED] -Original Message- From: Reynolds, Wendy J [mailto:[EMAIL PROTECTED] Sent: Monday, November 10, 2003 12:06 PM To: WEDI SNIP Privacy Workgroup List Subject: business associate - yes or no? I am in the process of reviewing a contact which will entail an agreement between us (a covered entity) and the contractor (another covered entity) in which the contractor will provide cancer screening/diagnostic tests to a specific category of women (income guidelines, age, etc.) per grant parameters. I am having trouble with this one, because usually "treatment" reasons do not necessitate a business associate agreement between two covered entities. However, we are paying the contractor a per capita rate to provide the services (diagnostic tests) to these patients. If patients need further treatment, they are referred back to us to take care of. In this situation, I am not sure the contractor is really providing "treatment" to the patients. Furthermore, in this situation, the contractor is providing this service on our behalf, for us, and are receiving money from us to provide these services. This arrangement does not fit the business associate exceptions or examples as listed on the OCR website. I have read the definition of treatment in the regs, but really think this arrangement should have a BAA. But of course the contractor disagrees. Am I being too picky? Any opinions out there? Wendy J. Reynolds, MPA, CHP EVMS Director of Privacy Program EVMS HS Clinical Auditor Eastern Virginia Medical School Fairfax Hall, 1st floor 721 Fairfax Avenue Norfolk, VA 23507 (757) 446-0337 [EMAIL PROTECTED] --- Outgoing mail is certified Virus Free. Checked by AVG anti-virus system (http://www.grisoft.com). Version: 6.0.537 / Virus Database: 332 - Release Date: 11/6/2003 --- The WEDI SNIP listserv to which you are subscribed is not moderated. The discussions on this listserv therefore represent the views of the individual participants, and do not necessarily represent the views of the WEDI Board of Directors nor WEDI SNIP. If you wish to receive an official opinion, post your question to the WEDI SNIP Issues Database at http://snip.wedi.org/tracking/. These listservs should not be used for commercial marketing purposes or discussion of specific vendor products and services. They also are not intended to be used as a forum for personal disagreements or unprofessional communication at any time. You are currently subscribed to wedi-privacy as: [EMAIL PROTECTED] To unsubscribe from this list, go to the Subscribe/Unsubscribe form at http://subscribe.wedi.org or send a blank email to [EMAIL PROTECTED] If you need to unsubscribe but your current email address is not the same as the address subscribed to the list, please use the Subscribe/Unsubscribe form at http://subscribe.wedi.org --- The WEDI SNIP listserv to which you are subscribed is not moderated. The discussions on this listserv therefore represent the views of the individual participants, and do not necessarily represent the views of the WEDI Board of Directors nor WEDI SNIP. If you wish to receive an official opinion, post your question to the WEDI SNIP Issues Database at http://snip.wedi.org/tracking/. These listservs should not be used for commercial marketing purposes or discussion of specific vendor products and services. They also are not intended to be used as a forum for personal disagreements or unprofessional communication at any time. You are currently subscribed to wedi-privacy as: [EMAIL PROTECTED] To unsubscribe from this list, go to the Subscribe/Unsubscribe form at http://subscribe.wedi.org or send a blank email to [EMAIL PROTECTED] If you need to unsubscribe but your current email address is not the same as the address subscribed to the list, please use the Subscribe/Unsubscribe form at http://subscribe.wedi.org
